Exam CISA topic 1 question 229 discussion

A. is the corect answer. The main purpose of an organization's internal IS audit function is to ensure effective risk management and internal controls through direct, dependent reporting to top management. The means to fulfill this main purpose is then e.g. the identification of necessary changes for a sustainable improvement process as listed under B.

A. Provide assurance. B is not correct because we identify but don’t initiate a control improvement, rather we make recommendations.

A. Provide assurance to management about the effectiveness of the organization's risk management and internal controls.

Assurance first of all

IS audit is not all about assurance. Audit reports usually indicate areas of necessary improvement in control effectiveness or implementations

A. Provide assurance to management about the effectiveness of the organization's risk management and internal controls.